You are correct.
If you just program the key into the two radios, and not the other 8, your conversations will not be overheard by the other radios.
You will tie up the channel, obviously.
However, there are a few settings you need to add to the non-encrypted radios that will make life easier for everyone:
1. Set Encryption Type to "Type 2" on ALL the radios.
2. Set up "Busy Channel Lockout" on the Channel Edit screen for all the radios. This will keep the other radios from accidentally transmitting over the top of you.
Setting Encryption Type to Type 2 will keep the other radios from hearing the garbled mess. The radios without encryption will mute the encrypted traffic and they won't know you guys are talking about them. If you don't set this, they'll hear the encrypted audio (will NOT decrypt it) and that'll get tiresome really quickly.
Another way to do this is to set up your RAN codes differently between the two channels. Your employees would have RAN 1 on their channel, and you and your other radio would be on a different RAN on channel 2 with the same frequency + encryption.
Setting the Busy Channel Lockout will keep the other 8 radios from accidentally keying up over the encrypted traffic, since they won't hear it, they'll have no way of knowing you are talking.
Do not program the keys into the other 8 radios. Even if you don't turn the encryption function on.
As for users guessing your encryption codes and programming them into the radios, I'd hope you'd have better control over your radios. If this really is a concern:
Go to the "Optional Features 1" page.
Select the "Common Page 1" tab.
At the bottom of that page is a button that says "Data Password".
Set up that data password for "Read Authorization Password" and "Overwrite Password".
Don't loose those passwords.
This will prevent someone from reading the radio with KPG-111 or overwriting the radios with KPG-111 if they don't have the code.
No reason your employees should be messing around with radio settings.